Host SSH daemon, if enabled, must ignore .rhosts files

SrednjaNivo 1Automatskavmware

Opis

Ignoring .rhosts files is crucial in hardening the SSH daemon on the host, ensuring that trust relationships are explicitly defined and not implicitly accepted, thereby reducing the attack surface. The audit reads /etc/ssh/sshd_config and requires IgnoreRhosts yes (unset = OpenSSH default yes). Runs in the ESXi Shell (busybox sh) as root.

Kako se proverava

Metod provere: Komanda ljuske

shell

f=/etc/ssh/sshd_config; [ -r "$f" ] || exit 1
v=$(awk 'tolower($1)=="ignorerhosts" {print tolower($2); exit}' "$f")
case "$v" in '') echo compliant ;; yes) echo compliant ;; *) echo "IgnoreRhosts $v" ;; esac

Očekivani izlaz: compliant

Kako se ispravlja

Metod ispravke: Smernica ili zakrpa infrastrukture

To remediate this recommendation, set IgnoreRhosts yes, restart SSH if authorized, and verify .rhosts-based trust is ignored.

Svojstva

Operativni sistemi: Bilo koji
Oznake: vmwareesxiservices
Referenca: CIS VMware ESXi 9.0 Benchmark v1.0.0 - 6.5.8 Host SSH daemon, if enabled, must ignore .rhosts files

Proverite ovaj računar

Pokrenite ovo na računaru za koji imate dozvolu za proveru. Skeniranje radi u režimu samo za čitanje.

shell

tmaegis scan --target vmware